feat: port MPF write path to WASM with browser demo

[paolino]

Refs #146

Summary

This PR carries the full MPF browser-write stack on top of main.

The original proof-layer blocker is resolved: MPF exclusion proofs with Aiken proof-format parity landed via #150 and are part of this branch history. On top of that, this PR wires the proof surface through the WASM executables, the browser demo, the docs site, and the preview deployment.

The latest fixes in this branch also close the last integration gap in the browser demo: the MPF write side now routes raw query keys through the same Aiken blake2b_256(key) trie path that the verifier expects, so inclusion proofs generated by mpf-write.wasm verify correctly in mpf-verify.wasm.

What Changed

Pure MPF / Aiken parity

• route MPF.Hashes.mkMPFHash through the pure Blake2b path used by csmt-verify
• split the pure MPF implementation into mts:mpf-write while keeping mts:mpf as the native re-export shim
• carry the merged MPF exclusion-proof implementation and the upstream Aiken fork-prefix fix from feat: add MPF exclusion proofs with Aiken parity #150
• add pure MPF.Verify verification for exact Aiken proof-step CBOR, covering both inclusion and exclusion
• add an explicit Aiken key-path helper and use it consistently in the verifier and the MPF browser-write path

WASM executables

• add mpf-write-wasm
  • mirrors the CSMT state-and-ops envelope
  • persists/restores MPFInMemoryDB
  • returns root, queried value, ptype, and Aiken proof bytes
  • now derives trie paths from raw browser keys exactly the way the verifier does
• add mpf-verify-wasm
  • verifies MPF Aiken proof bytes against a trusted root
  • accepts the extra query context MPF needs: key and optional value
• keep the browser proof tags aligned with the write response
  • 0 = inclusion
  • 1 = exclusion
  • 0xff = no proof because the forest is empty

Browser demo and packaging

• add verifiers/browser-write-mpf/
  • IndexedDB-backed state persistence
  • insert/delete UI
  • proof generation for inclusion and exclusion
  • independent verification through mpf-verify.wasm
  • undo/redo parity with the existing CSMT demo
• expose mpf-wasm-write-demo in flake.nix
• add nix/docs.nix and stage all three demos into the MkDocs site
  • verify demo
  • CSMT write demo
  • MPF write demo
• add docs pages for the CSMT write demo and the MPF write demo

WASM dependency cleanup

• remove the stray memory / basement dependency from mpf-write
• specialize the MPF serializers to raw ByteString
• this is what makes the real wasm32-wasi cross-build succeed instead of only the native -fwasm component build

Lint cleanup

• clear the remaining MPF HLint blockers in the touched verifier and test modules so CI can pass on the merge commit

Verification

• nix develop --quiet -c cabal build -O0 -fwasm exe:mpf-verify-wasm exe:mpf-write-wasm
• nix develop --quiet -c just hlint
• nix develop --quiet -c just test 'MPF.Verify'
• ./dist-newstyle/build/x86_64-linux/ghc-9.8.4/mts-0.4.0.0/t/unit-tests/build/unit-tests/unit-tests --match MPF.Verify
• ./dist-newstyle/build/x86_64-linux/ghc-9.8.4/mts-0.4.0.0/t/unit-tests/build/unit-tests/unit-tests --match MPF.Blake2b
• ./dist-newstyle/build/x86_64-linux/ghc-9.8.4/mts-0.4.0.0/t/unit-tests/build/unit-tests/unit-tests --match MPF.Proof.Insertion
• ./dist-newstyle/build/x86_64-linux/ghc-9.8.4/mts-0.4.0.0/t/unit-tests/build/unit-tests/unit-tests --match MPF.ProofCompat
• direct write→verify protocol smoke for raw browser keys:
  • key=a, value=a yields ptype=0, proof 9fff, verifier exit 0
  • key=a, value=b yields ptype=0, proof 9fff, verifier exit 0
• previously on this branch:
  • nix build .#mpf-wasm-write-demo
  • nix build .#docs
  • staged docs smoke for demo-write-mpf/index.html, mpf-write.wasm, and mpf-verify.wasm

Review Guidance

Start here:

• specs/004-mpf-wasm-write-demo/
• lib/mpf-write/MPF/Proof/Exclusion.hs
• lib/mpf-write/MPF/Verify.hs
• app/mpf-write-wasm/Main.hs
• app/mpf-verify-wasm/Main.hs
• verifiers/browser-write-mpf/
• nix/wasm.nix
• nix/docs.nix
• flake.nix

Remaining State

The branch is up to date and ready to merge once CI is green.

[github-actions]

Verify demo (read side): https://lambdasistemi-haskell-mts-pr-147.surge.sh
Build + prove + verify demo (CSMT write side): https://lambdasistemi-haskell-mts-pr-147.surge.sh/write-csmt/
Build + prove + verify demo (MPF write side): https://lambdasistemi-haskell-mts-pr-147.surge.sh/write-mpf/